Protocol log analysis with constraint programmingsmt2014.it.uu.se/slides/grinchtein.pdf · Protocol log analysis with constraint programming Mats Carlsson Olga Grinchtein Justin Pearson

Protocol log analysis with constraint programming

Mats Carlsson Olga Grinchtein Justin Pearson

Outline

• Overview

• LTE Radio Access Network

• A case study Public Warning System

• Testing Procedure

• Protocol log generation

• Protocol log analysis

• Ongoing work

2

Overview

• The LTE Radio Base Station (RBS) is SUT at our department at Ericsson.

• The LTE RBS communicates with the User Equipment (UE).

• The LTE RBS has different functions. Our case study is Public Warning System.

3

Overview

• Test harness should analyze UE protocol logs

• Protocol logs are sequences of messages with timestamps

• Number of logs with errors should be generated for testing telecommunication test harness

• We use constraint solver for modeling and generation of protocol logs ([DATE’14])

• Constraint solver can also be used for protocol log analysis

4

LTE Radio Base Station (eNodeB)

LTE Radio Access Network consists of LTE Radio Base Stations (RBS), which support the LTE air

interface and performs radio resource management.

An eNB connects to User Equipment (UE) via the air interface.

LTE RBSes are interconnected with each other by means of the X2 interfaces.

LTE RBSes are also connected by means of the S1 interface to the Evolved Packet Core

eNB

MME / S-GW MME / S-GW

eNB

eNB

S1

S1

S1

S1

X2

X2

X2

E-UTRAN

3GPP TS 36.300

Mobility Management Entity (MME)

Serving Gateway (S-GW)

UE

User Equipment (UE)

5

6

Public Warning System

2. Write-Replace Warning Request

1. Emergency Broadcast Request

4. Emergency Broadcast Response

3. Write-Replace Warning Confirm

CBC

0. Registration procedures

8. Record success/failure of message delivery in trace record

7. User Alerting

6. Cell Broadcast delivery

5. Write-Replace Warning Request

6. Write-Replace Warning Response

UE CBE eNodeB MME 3GPP TS 23.041

Cell Broadcast Entity (CBE)

Cell Broadcast Center (CBC)

Mobility Management Entity (MME)

User Equipment (UE)

Public Warning System

eNodeB UE

paging

system information

system information

system information

paging

system information

The eNodeB sends different

types of system information

messages

• SIB1 (schedulingInfoList)

• SIB10 (primary notification)

• SIB11 (secondary notification)

Secondary notification can come

in one or several segments

7

Testing Procedure 1. Test harness initializes some parameters in eNB. 2. Test harness initiates logging in UE simulator 3. Test harness initiates transmission of messages between

MME simulator and eNB 4. Test harness captures and analyses UE protocol log.

3 2 1

4

8

UE protocol log generation ([DATE’14])

• Modelling in Sicstus Prolog • Model describes how UE acquires primary and

secondary notifications sending by eNB after receiving one warning message from MME

• The model is a set of constraints on parameters, which represent timestamps, content of messages or indicate if a message should appear in log.

• Parameters are grouped into lists, that is a Prolog data-structure

• Inject faults into the model • Based on solutions provided by Sicstus Prolog we

generate UE protocol logs

9

Paging messages PagPN is array of timestamps of paging messages of primary notification

PagSN is array of timestamps of paging messages of secondary notification

paging

paging timeline

timeline

PagPN

PagSN

10

SIB1 • SIB1PNtime is array of timestamps of SIB1 messages after

paging messages of primary notification

• SIB1PNtype is array of values from 0 to 3 that indicates whether SIB1 contain schedulingInfoList for SIB10 and/or SIB11

timeline

timeline

SIB1PNTime

PagPN

SIB1P

NTim

e1

SIB1P

NTyp

e1=2

SIB1P

NTim

e4

SIB1P

NTyp

e4=2

SIB1

PN

Time

nd

PC

SIB1P

NTyp

en

dP

C=1

11

SIB11 • SIB11Time is array of timestamps of SIB11

messages

• SIB11Segment is a array of segment numbers

timeline

SIB11Time

timeline

PagSN 12

Protocol log analysis • Our approach is to implement test harness using

constraint solver

• Arrays contain correct timestamps of paging messages

• Arrays contain timestamps and content of messages from the log. First timestamp can be a variable.

• Two stages

– Check correctness of paging messages

– Check correctness of SIB1, SIB10 and SIB11 messages

• Boolean parameters indicate errors in logs

• Minimize sum of Boolean parameters 13

Minizinc

• Constraint specification language

• Solver independent

• Separation data from model

• Model consists of variable declarations and constraint definitions

• Scalar types (Booleans, integers, floats) and compound types (sets, arrays)

• Comparisons, arithmetic operations(+,∙,sum), logical operations (\/,/\, forall, exists), set operations, array operations

14

Model in Minizinc Boolean variables 𝑆𝐼𝐵11𝑎𝑓𝑡𝑒𝑟𝑝𝑎𝑔𝑖𝑛𝑑 and 𝑆𝐼𝐵11𝑝𝑒𝑟𝑖𝑜𝑑𝑖𝑐𝑖𝑡𝑦𝑖𝑛𝑑

SIB11 message after last paging message of secondary notification • ∃ 1 ≤ 𝑖 ≤ 𝑛𝑢𝑚𝑏𝑒𝑟𝑆𝐼𝐵11𝑙𝑜𝑔

𝑆𝐼𝐵11𝑇𝑖𝑚𝑒𝐿𝑜𝑔𝑖 > 𝑃𝑎𝑔𝑆𝑁𝑛𝑢𝑚𝑏𝑒𝑟𝑜𝑓𝑏𝑟𝑜𝑎𝑑𝑐𝑎𝑠𝑡𝑠

↔ 𝑆𝐼𝐵11𝑎𝑓𝑡𝑒𝑟𝑝𝑎𝑔𝑖𝑛𝑑 = 1

Periodicity of SIB11 messages • (∀ 2 ≤ 𝑖 ≤ 𝑛𝑢𝑚𝑏𝑒𝑟𝑆𝐼𝐵11log )

(( 𝑆𝐼𝐵11𝑇𝑖𝑚𝑒𝑙𝑜𝑔𝑖 − 𝑆𝐼𝐵11𝑇𝑖𝑚𝑒𝑙𝑜𝑔𝑖−1 𝑚𝑜𝑑 𝑠𝑖𝑃𝑒𝑟𝑆𝐼𝐵11 = 0)

↔ 𝑆𝐼𝐵11𝑝𝑒𝑟𝑖𝑜𝑑𝑖𝑐𝑖𝑡𝑦𝑖𝑛𝑑𝑖 = 0)

15

Ongoing work • Modelling in Minizinc acquiring by UE primary and secondary

notifications sending by eNB after receiving several warning

messages from MME

delay

Message 1 SIB10,SIB11

Message 2 SIB10

Message 3 SIB11

Message 4 SIB11

Message 5 SIB10, SIB11

SIB10

SIB11

SIB10

SIB11 SIB11 SIB11

SIB10

16